[cao-evolution:compiler-security] Compiler and security scan findings across 53 gh-aw workflows

Compiling all 53 GitHub Agentic Workflows in `githubnext/gh-aw-cao` at SHA `c2719f56d1f3987345f910fc7ca7d8694e517b36` succeeded, but the compiler's full validation suite exited with code 1. actionlint found 74 issues (72 shellcheck `SC1003` quoting warnings in a shared script fragment, 2 real `[expression]` type errors referencing an undefined `safe-outputs-app-token` property). zizmor found 34 Critical, 224 High, 789 Medium, 391 Low, and 322 Informational findings across the compiled lock files (dominant: `secrets-outside-env`, `undocumented-permissions`, `anonymous-definition`, plus a `github-app` High finding repeated in nearly every workflow and 33 `artipacked` findings). grype found 55 Critical/High CVEs (198 unique CVE IDs) across 9 container images, mostly in Alpine's `libssl3`/`libcrypto3`/`curl` stack and one Debian `libc6`/`libssl3` pair in `github-mcp-server`. `grant` failed strict license-policy enforcement with 1246 findings (GPL-2.0-only, LGPL variants, and other copyleft/non-approved licenses baked into base images). runner-guard's poutine-integrated scanner flagged one Medium finding (`RGS-005`, excessive write permissions on the untrusted-trigger-adjacent `agentic_commands.yml` command router). Highest-severity, most actionable items: the two real actionlint `[expression]` type errors (undefined `safe-outputs-app-token`) and the 34 Critical container CVEs, since these are concrete correctness/security defects rather than style or licensing policy noise.

**Action:** Assign this issue to Copilot using **Agent prompt** below; review its pull request and merge only after the full compiler and security scan passes.

Failure details

- **Target repository**: `githubnext/gh-aw-cao`
- **Compiler exit code**: `1`
- **Workflow sources checked**: `53`
- **Generated lock files checked**: `53`
- **Result**: `findings`

| Tool | Workflow / Image | Severity | Finding | Remediation |
|---|---|---|---|---|
| actionlint (expression) | self-care-dashboard-performance.lock.yml:2358, self-care-pages-health.lock.yml:2264 | error | Property `safe-outputs-app-token` is not defined in the referenced job outputs object type | Fix the `.md` source's step/job output reference or context expression that produces this generated line; recompile and confirm the type error clears |
| actionlint (shellcheck SC1003) | 72 occurrences across ~24 lock files (e.g. dashboard-authoring-corpus, eu-cra-compliance-*) | error (style) | `echo 'This is how it'\''s done'` — unescaped single quote in an example/demo shell snippet shared across workflow templates | Locate the shared source snippet emitting this example string and properly escape the embedded apostrophe |
| zizmor | nearly all 53 lock files | High | `github-app`: dangerous use of GitHub App tokens (~52 occurrences) | Review each flagged step; scope the App token usage or follow zizmor's documented mitigation for `github-app` |
| zizmor | many lock files | Medium | `secrets-outside-env` (444 occurrences): secrets referenced without a dedicated `environment:` | Move secret references into a job `environment:` block where feasible |
| zizmor | many lock files | Low/Informational | `undocumented-permissions` (309), `anonymous-definition` (313): permissions blocks lacking explanatory comments; anonymous workflow/job definitions | Add explanatory comments to `permissions:` blocks in generated templates; name workflow/job definitions |
| zizmor | 8 lock files | Low | `artipacked` (33 occurrences): checkout/artifact patterns that may leak credentials | Review checkout/persist-credentials configuration in the shared workflow template |
| zizmor | pr-reviewer, self-care-primer-brand-checker, self-care | Informational | `template-injection` (9 occurrences): template expansion usable for code injection | Confirm inputs are from trusted context only; add sanitization if untrusted data flows into the expression |
| grype | alpine:latest, node:lts-alpine | Critical | CVE-2026-63073, CVE-2026-75803 in `libcrypto3`/`libssl3` (fix: 3.5.8-r0) | Bump base image tag / rebuild to pick up patched Alpine package versions |
| grype | gh-aw-firewall/api-proxy, cli-proxy, squid | Critical | CVE-2026-19931, CVE-2026-18924 in `curl`/`libcurl` (fix: 8.22.0-r0) | Rebuild firewall images against an updated Alpine base with patched curl |
| grype | github-mcp-server:v1.12.1 | Critical | CVE-2026-5450 (`libc6`), CVE-2026-75803 (`libssl3`, Debian) | Rebuild/update base Debian image for github-mcp-server |
| grant | 9 container images | policy | 1246 license-policy violations (GPL-2.0-only, LGPL-*, and other non-approved licenses in base image packages) | Review `grant` policy against actually-required packages; either accept documented exceptions or switch to slimmer/distroless bases |
| runner-guard (poutine) | .github/workflows/agentic_commands.yml | Medium | `RGS-005`: write-level permissions alongside command-router content triggerable by external users | Confirm the command router's trigger/permission combination is intentional and documented, or narrow permissions |

Agent prompt

1. Assign this issue to Copilot.
2. Configure its MCP client to launch `gh aw mcp-server` over stdio from the target repository, then give it the prompt below. Require the server's `fix` and `compile` tools; never allow direct edits to generated `.lock.yml` files.
3. Review the resulting pull request and require the same full compiler and security scan to pass before merge. If a finding needs human action, require the agent to stop and explain it.

**Agent prompt**

Fix the reported gh-aw compiler and security findings in this repository. Change only `.github/workflows/*.md` sources and directly related files; never edit generated `.lock.yml` files. Use the gh-aw MCP server's `fix` and `compile` tools, rerunning compilation with strict validation, model checks, actionlint, shellcheck, yamllint, zizmor, poutine, runner-guard, grant, grype, and syft until clean. Review generated lock-file diffs, preserve existing behavior, and stop with a concise explanation if a finding cannot be fixed safely.

Raw evidence

Compiler summary:
```
Target: githubnext/gh-aw-cao
Exit code: 1
Workflow sources: 53
Compiled locks: 53
```

Actionlint summary:
```
✓ Checked 53 workflow(s)
⚠ Found 74 issue(s) (74 error(s))
Issues by type:
• shellcheck: 72
• expression: 2
```

zizmor severity totals: 34 Critical, 224 High, 789 Medium, 391 Low, 322 Informational (across rule types: adhoc-packages 25, anonymous-definition 313, artipacked 33, github-app 52, obfuscation 3, secrets-outside-env 444, template-injection 9, undocumented-permissions 309).

grype: 55 Critical/High findings, 198 unique CVE IDs across 9 scanned container images (alpine:latest, ghcr.io/github/gh-aw-firewall/{agent,api-proxy,squid,cli-proxy}:0.28.16, ghcr.io/github/gh-aw-mcpg:v0.4.21, ghcr.io/github/gh-aw-node, ghcr.io/github/github-mcp-server:v1.12.1, node:lts-alpine).

grant: `✗ grant failed — strict mode: grant found 1246 license policy finding(s) in container images`.

runner-guard/poutine: 1 Medium finding, `RGS-005` on `.github/workflows/agentic_commands.yml`.

Control plane context

- Correlation ID: `34918207684-94`
- Central repository: `githubnext/gh-aw-cao`
- Control plane run URL: `https://github.com/githubnext/gh-aw-cao/actions/runs/34918207684`

> Generated by [:shield: CAO Evolution / AW Compiler Security](https://github.com/githubnext/gh-aw-cao/actions/runs/34918627770) · copilot · auto · 49.3 AIC · ⌖ 9.51 AIC · ⊞ 12.7K · [◷](https://github.com/search?q=repo%3Agithubnext%2Fgh-aw-cao+is%3Aissue+%22gh-aw-workflow-call-id%3A+githubnext%2Fgh-aw-cao%2Fcao-evolution-compiler-security%22&type=issues)
> - [x] expires on Sep 29, 2026, 2:08 AM UTC

Start with the 53 .github/workflows/*.md sources and the compiler output for self-care-dashboard-performance and self-care-pages-health; do not edit generated .lock.yml files. Inspect the shared shell example, container image definitions, and .github/workflows/agentic_commands.yml, then run the full compiler and security scan. Done means the reported validation, vulnerability, permission, and policy findings are resolved or explicitly explained.

Written by the indexing model from the issue text.